CVE-2014-3682

XML external entity XXE vulnerability in the JBPMBpmn2ResourceImpl function in designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java in jbpm-designer 6.0.x and 6.2.x allows remote attackers to read arbitrary files and possibly have other unspecified impact by importing a crafted BPMN2 file...

CVE-2014-3682

XML external entity XXE vulnerability in the JBPMBpmn2ResourceImpl function in designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java in jbpm-designer 6.0.x and 6.2.x allows remote attackers to read arbitrary files and possibly have other unspecified impact by importing a crafted BPMN2 file...

CVE-2014-3682

XML external entity XXE vulnerability in the JBPMBpmn2ResourceImpl function in designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java in jbpm-designer 6.0.x and 6.2.x allows remote attackers to read arbitrary files and possibly have other unspecified impact by importing a crafted BPMN2 file...

CVE-2014-3682

CVE-2014-3682 affects jbpm-designer 6.0.x and 6.2.x, due to an XML External Entity (XXE) vulnerability in JBPMBpmn2ResourceImpl.java that allows reading arbitrary files via a crafted BPMN2 import. Public documents confirm the root cause and impact; Red Hat advisories RHSA-2015:0234/0235 indicate ...

PT-2015-3732

Name of the Vulnerable Software and Affected Versions jbpm-designer versions 6.0.x through 6.2.x Description The issue allows remote attackers to read arbitrary files and possibly have other unspecified impact by importing a crafted BPMN2 file, due to an XML external entity XXE vulnerability in t...

CVE-2014-3682: Undefined Security Weakness

XML external entity XXE vulnerability in the JBPMBpmn2ResourceImpl function in designer/bpmn2/resource/JBPMBpmn2ResourceImpl.java in jbpm-designer 6.0.x and 6.2.x allows remote attackers to read arbitrary files and possibly have other unspecified impact by importing a crafted BPMN2 file...

Fixed in Apache Standard Taglib 1.2.3

Important: Information Disclosure CVE-2015-0254 Apache Standard Taglibs before 1.2.3 allows remote attackers to execute arbitrary code or conduct external XML entity XXE attacks via a crafted XSLT extension in a JSTL XML tag. This issue was identified by the David Jorm of IIX and made public on 2...

Xxe

The Monitoring Administration pages in PNMsoft Sequence Kinetics before 7.7 allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2014-6302

The Monitoring Administration pages in PNMsoft Sequence Kinetics before 7.7 allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2014-6302

PNMsoft Sequence Kinetics prior to version 7.7 is affected by an XML External Entity (XXE) vulnerability in the Monitoring Administration pages, allowing remote attackers to read arbitrary files via XML external entity declarations combined with entity references. The root cause is XXE processing...

PT-2015-3847

Name of the Vulnerable Software and Affected Versions PNMsoft Sequence Kinetics versions prior to 7.7 Description The issue allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

CVE-2014-6302: Undefined Security Weakness

The Monitoring Administration pages in PNMsoft Sequence Kinetics before 7.7 allow remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity XXE issue...

Important: Red Hat Security Advisory: Red Hat JBoss BPM Suite 6.0.3 security update

Red Hat JBoss BPM Suite 6.0.3 roll up patch 2, which fixes multiple security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring...

RESTEasy: XXE via parameter entities

It was found that the fix for CVE-2012-0818 was incomplete: external parameter entities were not disabled when the resteasy.document.expand.entity.references parameter was set to false. A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible...

Apache ActiveMQ 5.x < 5.10.1 / 5.11.0 Multiple Vulnerabilities

The version of Apache ActiveMQ running on the remote host is 5.x prior to 5.10.1 / 5.11.0. It is, therefore, potentially affected by multiple vulnerabilities : - An unauthenticated, remote attacker can crash the broker listener by sending a packet to the same port that a message consumer or produ...

Xxe

The ContentBlockEx method in Workarea/ServerControlWS.asmx in Ektron Content Management System CMS 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference within an XML document named i...

CVE-2015-0923

The CVE-2015-0923 vulnerability affects Ektron CMS versions 8.5, 8.7 before 8.7sp2, and 9.0 before sp1, in ContentBlockEx via Workarea/ServerControlWS.asmx. An XML External Entity (XXE) flaw arises when an XML document is named in the xslt parameter, allowing remote, unauthenticated readers to ac...

CVE-2015-0923: Undefined Security Weakness

The ContentBlockEx method in Workarea/ServerControlWS.asmx in Ektron Content Management System CMS 8.5 and 8.7 before 8.7sp2 and 9.0 before sp1 allows remote attackers to read arbitrary files via an external entity declaration in conjunction with an entity reference within an XML document named i...

PT-2015-4973

Name of the Vulnerable Software and Affected Versions Ektron Content Management System CMS versions 8.5 through 8.7 before 8.7sp2 Ektron Content Management System CMS version 9.0 before sp1 Description The issue allows remote attackers to read arbitrary files via an external entity declaration in...

Adobe BlazeDS XML / XXE Injection Vulnerabilities (APSB10-05) - Active Check

Adobe BlazeDS is prone to an XML-injection vulnerability and an XML external entity XXE injection vulnerability. SPDX-FileCopyrightText: 2015 SCHUTZWERK GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...